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SUMMARY 


Considerations of crew utilization and crew station design are 
placed in the context of total system development. A model of the 
development process is presented in which the relations ideally existing 
between the different phases are clarified. Special attention is given 
to the functions, design, and crew performance phases as they relate to 
the development of cockpit indicator displays. 

The objective of the functions phase is to define the functional 
requirements of man and machine. The functions allocated to the pilot 
constitute the information output which is required of him. The parame- 
ters of those functions are his input information requirements, and 
their indication in cockpit displays is a functional requirement of 
the machine . 

The definition of these functional requirements is accomplished 
through analysis of the system’s mission, within the constraints of the 
technological and human resources which are available for the accomplish- 
ment of that mission. The resulting performance specifications must 
also be taken into account as they become available. Functions are 
defined on each of the system's output variables. These functions are 
then allocated between man and machine, subsidiary functions being 
defined where necessary. Requirements are established separately for 
each longitudinal segment of the mission which exhibits a distinct 
functional organization. 

The objective of design is to specify equipment (e.g., indicator 
displays) which will satisfy the machine-allocated functional require- 
ments developed in the functions phase. The design specifications are 
constrained in the first instance by the available human and technologi- 
cal resources, and subsequently by the feedback of performance 
specifications. 

In the crew performance phase there is a synthesis of equipment 
design specifications with the pilot -allocated functional requirements. 
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The resulting specification of pilot performance is fed hack to the 
design and functions phases, where account must be taken of the task's 
difficulty level. Excessive task difficulty necessitates redesign of 
equipment and/or reallocation of functions between man and machine. 

The development process is thus seen to be an iterative one, continuing 
until functional requirements and design specifications combine to 
specify performance whose realization is feasible. 

Two general approaches to crew task definition are possible: simu- 


lation and rational synthesis. Simulation is particularly attractive 
because of the increase in confidence which must attend a demonstration L 

of feasibility in simulated operation. Rational synthesis must also be 1 

employed, however, because of the impossibility of fully simulating 1 

operational conditions. 2 


INTRODUCTION 


In designing an aircraft cockpit, it used to be possible to rely 
upon a vast background of successful experience in the operational 
environment. Instrument systems which had proved themselves in earlier 
vehicles were simply taken over, with their indicator displays intact. 
Minor adaptations may have been necessitated by the somewhat more 
exacting requirements of the new vehicle. But little or no deliberate 
attention was paid to the pilot's role in the man-machine system, or 
to the implications of that role for equipment design. 


This approach to cockpit design was not systematic in the sense of 
proceeding from a clear cut statement of requirements to a system which 
would satisfy those requirements. But it worked. Whatever the require- 
ments were, they could usually be solved by minor adaptations of estab- 
lished techniques. This was true because the problems were but minor 
variations on familiar problems. 

But this casual approach to crew station design is not possible 
in the case of Dyna-Soar. The experience which served so well in the 
past simply does not apply to the problems of boost, orbit, reentry, 
and hypersonic glide. A systematic approach to the pilot's role and 
to cockpit design is indispensable if we are to deal competently with 
these problems. It is the purpose of this paper to describe such a 
systematic approach and to illustrate its application to Dyna-Soar. 

The diagram in figure 1 is an idealized model of the development 
process. It will serve to place considerations of crew utilization and 
crew station design within the context of total system development. The 
boxes in the diagram represent phases which would ideally occur in the 
development of any complex man -machine system. The arrows connecting 



them represent the relations which would ideally exist between the phases 
Three of these developmental phases lie within the scope of the present 
paper. They are the functions, design, and crew performance phases. 

In the functions phase of system development, an analysis of the 
system's mission is carried out. The mission has previously been defined 
as the diagram indicates, through operations research. The output of 
the functions phase is a set of functional requirements, allocated 
between the system's crew and the residual system. These requirements, 
represented in the diagram by hollow arrows, are defined and allocated 
subject to constraints Imposed by the resources, both human and techno- 
logical, which are available for mission accomplishment. 

The functional requirements which are allocated to the residual 
system constitute the input to the design phase. The design output con- 
sists of specifications for equipment. These are represented in the 
diagram by solid black arrows. The use of solid arrows to symbolize 
the output of design, in contrast with the use of hollow arrows for its 
input, signifies that abstract functional requirements are given a con- 
crete interpretation in the design phase. As the diagram indicates, 
this interpretation is constrained by the available human and technolog- 
ical resources. 

Finally, in the crew performance phase, there is a synthesis of 
equipment design with the crew -allocated functional requirements. The 
result is a specification of the tasks to be performed by the crew. The 
performance specifications are represented in the diagram by striped 
arrows, since they are determined jointly by functional requirements 
and equipment specifications. As the diagram indicates, they are fed 
back to the functions and design phases, where their feasibility is 
evaluated. 

If the tasks to be performed by the crew axe found upon evaluation 
to be excessively difficult, the functional requirements may be reallo- 
cated between crew and residual system, or the equipment may be rede- 
signed, or both. In any case, new crew performance specifications are 
defined and fed back to the functions and design phases for evaluation. 
This iterative process continues until all crew performance specifica- 
tions are found to be feasible. 

While this process is going on, a similar process leading to a 
feasible set of machine performance specifications is simultaneously 
going to completion. This complementary process is indicated at the 
top of the diagram. When both processes are complete, equipment speci- 
fications are released to production and crew performance specifications 
to training and organization. The ensuing events, which are indicated 
in the diagram, are beyond the scope of this paper. 
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THE FUNCTIONS PHASE 


In considering the functions phase of system development, one point 
is worthy of emphasis. Functional requirements are abstract. They are 
not specifications of crew performance, nor do they specify equipment. 
Functional requirements allocated to the machine may be interpreted in 
a variety of designs. Similarly, there are various ways to interpret 
crew -allocated functions as crew performance. 

The mission which is analyzed in the functions phase is a general 
statement of what the system must be to achieve 'its operational objec- 
tives in its operational environment. The functional requirements which 
are defined in this phase are the detailed logical consequences of the 
mission' and of the available resources. The mission which has been 
assumed as a point of departure for our studies was defined in Phase I. 

As development proceeds, changes in this mission will be fed into the 
functions phase. The functional requirements which have been defined 
will then be modified appropriately. 

The definition and allocation of functional requirements, as pre- 
viously mentioned, are subject to certain constraints. These constraints 
are imposed by the resources which are available, or expected to be 
available, for the accomplishment of the system’s mission. The major 
part of this symposium has been concerned with the resources of inanimate 
technology. But there is a different class of resources - the potential 
utility of the pilot. Just what is this potential utility? The pilot’s 
contribution to mission accomplishment consists, in general, of satisfying 
certain of the system’s functional requirements which may be allocated 
to him. 

Two steps are involved in the functions phase of system development: 
First, the required performance of the system must be specified and, 
second, the responsibility for realizing the required performance must 
be allocated between man and machine. 


Specification of Required Performance 

In order to specify the required performance of the system, a set 
of variables must be chosen. These variables are termed "outputs." 

The required value of each output can then be defined as a function of 
one or more parameters. The functions so defined, called "output 
functions," are the required performance of the system. The parameters, 
called "input parameters," constitute the system’s requirement for input 
information. 
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In order for the required value of an output to be realized, two 
things are necessary. First, the output must be programed - i.e., a 
series of decisions must be made as to its required value. And second, 
the decisions must be implemented - the values decided upon must be 
brought about. These things are represented diagrammatic ally in figure 2. 
In that figure, output functions are represented by double vertical lines. 
Since the required value of an output is a function of one or more param- 
eters, programing may be conceived as a functional linkage between param- 
eter and function. Such a linkage is diagramed on the left-hand side 
of each function symbol. Thus, if required velocity is a function of 
actual position, the programing of velocity is symbolized by the arrow 
linking actual position to required velocity. The implementation of a 
decision respecting the required value of an output is diagramed as a 
functional linkage on the right-hand side of the function symbol. In 
this case, a decision as to required velocity is implemented through 
an acceleration program. The implementation of decisions respecting 
required acceleration is not represented in this figure. 

It will be noticed that in the figure required acceleration is 
linked on the left to both required and actual velocity. This implies 
that required acceleration is a function of both parameters. Decisions 
respecting required acceleration must be based on information as to 
both actual and required velocity. 

The pattern of functional linkages between the various output func- 
tions of the system and their input parameters is the basis of the sys- 
tem’s functional organization. Diagrams such as these are of great 
utility in defining functional requirements and in allocating them 
between man and machine. Their useful interpretation, however, demands 
that they be supplemented by a more detailed statement of the functions 
involved. The range and domain of each function, the form of each 
function’s dependence upon its parameters, and the allowable variation 
of each output about its required value must all be explicitly defined. 

In the analytical work which has been completed to date, the required 
performance of the system has been specified with respect to 15 outputs 
(fig. 5) • Of these, two define the vehicle's position in space, three 
define its velocity vector, five are the factors which control its 
acceleration vector, and five are the changes or rates of change of 
those factors. The required value of each of these outputs has been 
expressed as a function of one or more input parameters. This has been 
done only for normal, or nonemergency, conditions. The analysis is 
presently being extended to the case in which one or more of the out- 
puts of the system or of its subsystems is out of tolerance. 
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Allocation of Functional Requirements 

A pattern of relations such as are diagramed in figure 2 is the 
basis of the system's functional organization. A complete diagram of 
that organization, however, must also represent the allocation between 
the man and machine of the responsibility for realizing the required 
outputs. It is a simple matter to incorporate this additional informa- 
tion. Functional linkages allocated to the pilot for realization are 
represented in figure 4 by broken arrows, while solid arrows symbolize 
those whose realization is allocated to the machine. In this figure 
there appear a number of single vertical lines. These symbolize the 
outputs required of various subsystems in support of the system's out- 
put functions. Such required subsystem outputs are referred to as sub- 
sidiary functions, or simply subfunctions. Subfunction symbols lying 
between solid and broken arrows represent man-machine interfaces. An 
interface is a display indication if the solid arrow lies on the left 
of its symbol, and a control action if the solid arrow is to the right. 
Besides the interfaces, another kind of subfunction is represented in 
figure 4 . This is the interpretation which the pilot must make of his 
sensory input. Such subfunctions as these are implicit responses 
required of the pilot. 

Now what does this diagram tell us? Briefly, it makes six 
statements : 

(1) Actual position is indicated to the pilot in a display. 

( 2 ) The pilot determines required velocity on the basis of that 
display indication. 

(3) Actual velocity is indicated to the pilot in a display. 

(I4.) The pilot reads that display indication and Interprets it as 
a sign of actual velocity. 

(5) The pilot correlates actual and required velocity and transmits 
the result as a control action. 

(6) The machine determines the required acceleration on the basis 
of the pilot's control action. 

This diagram is a comprehensive way of presenting the functional organiza- 
tion of the man-machine system. Once again, however, its useful interpre- 
tation requires supplementary information. Besides the detailed statements 
of the output functions there must be similar statements of the subsidiary 
functions. Over what range must a parameter be indicated, with what 
precision, and with what rates of change? With what precision must the 
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pilot read and interpret the indication, and as a sign of what? What 
must the pilot correlate, how often, and what is the form of the 
correlation? 

An initial allocation has been made of the responsibility for 
realizing our fifteen output functions under nonemergency conditions. 

This trial allocation was guided by a policy of maximum pilot utiliza- 
tion. Under this policy, any functional requirement which is not clearly 
beyond human capability is allocated to the pilot. The resulting func- 
tional organization represents the maximum work load which can be imposed 
upon the pilot insofar as the normal guidance and control of the vehicle 
is concerned; Emergency operations and the management of subsystems can 
of course increase his workload above this level. This policy was adopted 
to establish a baseline from which pilot utilization can be reduced as 
may appear desirable and feasible in the ensuing studies. 


Segmentation of Mission 

In this discussion of the system's functional organization, there 
is one question which must have occurred to all of you. Doesn't the 
functional organization change during the course of the mission? It 
certainly does. For this reason it has been necessary to divide the 
mission into a series of longitudinal segments, each characterized by 
a particular functional organization. 

The process of segmentation is an iterative one. It begins with a 
set of trial segments. An attempt is made to define the system's func- 
tional organization in each. If analysis discloses a change in organi- 
zation during any of these, it is immediately divided into two or more 
new trial segments. Analysis may also show two or more trial segments 
to have the same organization. Such trial segments are combined. This 
process continues until a set of mission segments is defined whose ele- 
ments taken serially constitute a restatement of the system's mission. 

Like the overall mission, each segment is characterized by certain 
objectives. The initial conditions necessary for the accomplishment of 
each segment must be among the objectives of the segment which precedes 
it. To insure that this would be the case, the initial trial segments 
were defined in reverse order. The process began with the vehicle 
safely at rest, its mission completed, and worked backward to launch. 

The mission segments which finally resulted are presented in figure 5. 
Their objectives are not given for reasons of security. Time does not 
permit any detailed consideration of these segments and their functional 
organizations. However, a quick look at a typical organization diagram 
may be of interest. Figure 6 is presented to illustrate the general 



2^2 



appearance of these diagrams. The functions represented there are 
defined in detail in the report from which this figure was taken. 


The Functional Requirements 

The mission has been divided into seven longitudinal segments, and 
the functional organization characterizing each segment has been dia- 
gramed. In these diagrams are indicated the allocation of functional 
requirements between man and machine. Just what are these requirements? 
In a word, they are for information. An information output is required 
of the pilot, and he in turn requires input information of the machine. 

In figure 4 the pilot’s information output is shown to be trans- 
mitted as a control action. In order to determine the required control 
action under the functional organization shown here, he must do two kinds 
of things. He must interpret display indications, and he must correlate 
the interpretations. One display indication is interpreted as a sign 
of required velocity, the other as a sign of actual velocity. The cor- 
relation of these interpretations, transmitted to the machine as a con- 
trol action, selects an acceleration which will tend to reduce their 
discrepancy. Correlation and interpretation, then, are the functional 
requirements allocated to the pilot. A full definition of these func- 
tional requirements would, as we have said, include a statement as to 
the form of the relations between the required responses and their 
parameters, or independent variables, and the allowable variation of 
the responses about their required values. 

If the pilot is not able to determine the parameters of his required 
responses with sufficient precision, they must be indicated to him by 
the machine. Twenty-two functional requirements for display indication 
are symbolized in figure 6. These are the requirements for input infor- 
mation which must be satisfied by the machine under the functional 
organization diagramed here. Once again, their full definition must 
include a statement as to the range of the required display indications 
and the allowable error of indication. 


THE DESIGN PHASE 


The functional requirements for display indication are among the 
inputs to the design phase. They are the only such inputs which will 
be considered in this paper. 

The design phase, like the functions phase, is constrained by the 
available resources. The sensing, computing, and indicating technologies 
impose practical limits on the displays which can be specified. Further 
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limits are imposed by the ability of a man to read a display indication 
within given tolerances of time and error. Subject to these constraints, 
displays are designed so as to facilitate the pilot’s required responses 
of interpreting and correlating. 

The outputs of the design phase, as far as this paper is concerned, 
are specifications for indicator displays. Displays are designed to 
satisfy the given functional requirements subject to the given con- 
straints. The concern of this paper, let it be noted, is with indicator 
displays, not with indicators. By this is meant that these specifica- 
tions are for what the pilot actually sees, and not for the mechanism 
of the indicator, which is hidden from him. 

In the design phase, display specifications were developed in three 
steps. First, the functional requirements were summarized. Second, a 
panel concept was defined to integrate the functional requirements. 

And third, the panel concept was elaborated in concrete detail. 

In the seven functional organization diagrams to emerge from the 
functions phase, there are denoted no less than 95 different requirements 
for display indication. For each of these a summary sheet was prepared. 

On that sheet was entered the parameter to be indicated, its maximum 
expected rate of change, and the required range of indication. This 
information was then supplemented on each summary sheet with data 
respecting the responses required of the pilot - viz., his interpreta- 
tions and correlations. Error tolerances were associated with each 
required response. (The reading tolerances are implicit in the allow- 
able error of interpretation.) These summary sheets contain a complete 
statement of the functional requirements for display indication; but 
although there were 95 distinct requirements, many of them were so nearly 
identical that they could be considered the same requirement. Accordingly, 
the summary sheets were collected into essentially homogeneous clusters. 

In this way, the number of functional requirements was reduced to some 
twenty, a much more manageable number. 

The integration of these requirements into an organic panel concept 
came next. In the definition of that concept these things were considered: 

(1) The presentation to the pilot of his required input information. 
This, of course, is the functional requirement to be satisfied. 

( 2 ) The facilitation of the pilot’s required responses of interpre- 
tation and correlation. The demands upon the pilot for these responses 
must not exceed his ability to make them within the given error toler- 
ances. The difficulty of his task is importantly influenced by the 
organization of the instrument panel. 




( 5 ) The state of the instrumentation art. This consideration is 
recognizable as the technological resources which constrain the design 
phase of development. 

The general concept which was defined and adopted for further elaboration 
is depicted in figure 7* The information needed by the pilot can be 
acquired from the displays denoted in that figure. 


It is interesting that so complex a welter of requirements for 
display indication can be satisfied by an instrument panel so simple in 
conception. The design of such a panel is possible only on the basis L 

of the exact functional requirements for display indication. Such a 1 

basis allows the conception of an uncluttered, starkly functional panel. 1 

2 

The individual displays were designed and arranged so as to facili- 3 

tate the required interpretations and correlations. And the demands 


imposed by the display specifications upon the state of the art have been 
held to a minimum. 

The third and final step was elaboration of the panel concept . In 
this step exact specifications were defined for the panel and for the 
individual displays. The dimensions and operating characteristics of 
the displays were specified. The scales and indices were designed in 
detail, and the use of color to facilitate interpretation, particularly 
in check reading, was explored. 

In presenting these specifications, great attention is being given 
to their rationale. The method by which they were developed lends 
itself to such documentation. The indication of any parameter on this 
instrument panel is justified by reference to the functional require- 
ments which are thereby satisfied. The particular form of the display 
in which it is indicated and the relation between that display and the 
rest of the panel are justified as attempts to facilitate the responses 
required of the pilot. Along with the specifications for indicator 
displays, suggestions for the instrumentation of those displays are 
being prepared. These suggestions include possible data sources and 
possible indicator mechanisms. 


THE CREW PERFORMANCE PHASE 


As noted in figure 1, it is in the crew performance phase that 
functional requirements join with equipment design to define the pilot's 
task. It will be clear from what has been said that both inputs are 
required to specify the performance required of the pilot. For given 
functional requirements his task will vary with the design of the 




indicator displays with which he is provided. And a given instrument 
panel may be used to satisfy a variety of functional requirements. 

Since both inputs are needed to specify the pilot’s task, it is 
also clear that a definitive statement that the task is feasible cannot 
be made on the basis of either input alone. Just as the pilot’s task 
changes with variation in either his functional requirements or his 
displays, so does the difficulty of that task. It is for this reason 
that his performance specifications are fed back to the functions and 
design phases. 

These specifications provide the basis for modifying the original 
design specifications and the functional requirements originally allo- 
cated to the pilot. If the initial performance specifications are not 
feasible - i.e., if their demands exceed the available human resources - 
they must be modified. And the performance required of the pilot can 
be modified only by modifying either his functional requirements or the 
design of his equipment. 

Two general approaches to the definition of performance requirements 
are available: rational synthesis and simulation. There are advantages 

and disadvantages to each method. 

The method of rational synthesis may also be called the armchair 
method. It assumes various forms. For example, a detailed series of 
concrete interactions of man and machine may be specified. These con- 
sist chiefly of the actuation of controls and the discrimination of 
display indications. The equipment and operational conditions are 
examined to determine whether these interactions are feasible, given 
the nature of the crew member. In this form the armchair method has 
been called "task analysis." Being independent of the laboratory, it 
can be carried out quickly and is useful for rough estimates of a task's 
feasibility. It does not often lend itself to exact statements, however, 
and does not inspire great confidence when applied to complex systems 
of any novelty. 

Simulation of the man -machine system, on the other hand, permits 
the study of a concrete analog of the system to which inference is made. 
Although this method is comparatively slow, being dependent on apparatus, 
it does lend itself to exact measurements. In this method the performance 
required of the pilot is demonstrated physically as the behavior of the 
experimental subject in a successful simulated operation. And the con- 
fidence in the feasibility of the pilot’s task which is inspired by such 
a demonstration is limited only by the fidelity of simulation. This 
fidelity is of course not perfect. Indeed, there is no practical way 
of simulating certain of the stresses which the operational system must 
be expected to encounter. About the only way of dealing with this 



problem is to supplement the method of simulation with rational synthesis 
The feasibility of the pilot's task is demonstrated in operations simu- 
lated under favorable conditions. Estimates are then made of the extent 
to which his performance will be degraded under operational stress. The 
paper by Euclid C. Holleman deals with some of the empirical bases upon 
which estimates of this kind may be made. 
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Figure 5 


FUNCTIONAL ORGANIZATION OF THE SYSTEM 
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